chromium/src/third_party/blink/web_tests/fast/replaced/object-set-type-with-no-data-crash.html - manifest_repos/chromium_src - Git at Google

 <!DOCTYPE html>
 <object id="target" type="text/html"></object>
 <script src="../../resources/testharness.js"></script>
 <script src="../../resources/testharnessreport.js"></script>
 <script>
   test(()=> {
     var target = document.getElementById("target");
     target.type = "text/html";
   }, "No crash or DCHECK failure");
 </script>
	<!DOCTYPE html>
	<object id="target" type="text/html"></object>
	<script src="../../resources/testharness.js"></script>
	<script src="../../resources/testharnessreport.js"></script>
	<script>
	test(()=> {
	var target = document.getElementById("target");
	target.type = "text/html";
	}, "No crash or DCHECK failure");
	</script>